Security

Your inbox knows everything about you. So Killer Email is built around a simple rule: see as little as possible, keep even less, and make no change without a clear limit or a deliberate click.

What the app reads

Killer Email searches unread and starred Gmail inbox mail, and unread and flagged Outlook messages in the Inbox folder only. Junk Email, Deleted Items, Archive and other Outlook folders are never read, and the app's Microsoft Graph allowlist blocks mailbox-wide or other-folder listing. On first connection, it looks back 30 days. Later, it reads new unread mail and newly starred Gmail or flagged Outlook mail when you open the app and sync, including periodic checks while the desk stays open. There is no background mailbox reader running while you are away.

Gmail returns metadata only: From, Subject, Date, Reply-To and Authentication-Results headers, Gmail labels, message and thread identifiers, and Gmail's preview snippet. Killer Email does not read full bodies for sorting. When you press Add to calendar it reads that one body, has the AI check the first 4,000 characters for event details, expanding only if those details are missing, with a hard maximum of 8,000 characters, and does not store the body. Gmail extracts text from plain text or HTML; Outlook requests text, but the response may contain HTML. It never reads attachments. Raw labels and authentication headers are used during sorting and sender checks, then discarded. Outlook returns message and conversation identifiers, sender, subject, received date, bodyPreview, read status, flag status and its Focused Inbox classification (Focused or Other). Its stored preview is limited to 500 characters. Outlook mail that Microsoft's Focused Inbox files under Other (not Focused) is quarantined without an AI action, unless you've kept mail from that sender before; flagged Outlook mail is never quarantined this way. If an account doesn't return a Focused Inbox classification, its mail goes to the AI as before. Outlook does not supply the Gmail authenticity headers, so it does not receive that unverified-sender check.

What the app can do

• Sort action items into Today, Next Week and Later inside Killer Email.
• Place promotions, social notifications, spam and other noise in an in-app Quarantine. Nothing is moved, labeled, trashed or deleted in Gmail or Outlook, and anything can be rescued.
• Remove Gmail's Unread label after you choose Done or Archive, or confirm Clear Quarantine with the exact item count. Done also removes Gmail's star when the item was starred. Outlook uses a mark-read request instead of Gmail labels, and Done requests clearing its flag.
• Generate a reply for review and editing. The originating Gmail or Outlook account receives the draft only after you approve saving it, and the server forces the recipient to the original sender. Killer Email never sends it. Gmail can retain the original thread; Outlook creates a new draft without reply-thread linkage.
• Propose an event title, description, date, time and duration for review. One event is created only after confirmation, on the primary Google calendar or default Outlook calendar of your selected connection, not necessarily the account the email arrived in. One Microsoft connection covers both mail and calendar. Connecting Outlook does not replace an already-selected calendar; when neither a selected calendar nor a Google calendar connection exists, it becomes the destination. Its title includes [Killer Email] and it has no guests.
• Record every Gmail, Outlook or calendar write in your Activity log.

A hard limit around Google

Google's Gmail permission is broader than Killer Email's job. Every Google request passes through one server-side function and a method, address and request-body allowlist before it can leave the app.

The allowlist permits only Gmail account identification, message search, metadata-only message reads, a full-text read of a single message when you ask to schedule it, removal of the Unread label (and the Starred label when you mark a starred item Done), Gmail draft creation, Google account or primary-calendar identification, and creation of a primary-calendar event containing only title, description, start and end.

Sending mail, trashing, deleting, importing, inserting, labeling, forwarding, filters, Gmail settings, thread changes, draft updates or deletion, Calendar event listing, and Calendar event editing or deletion are blocked in code.

A hard limit around Microsoft

Outlook requests openid, profile, email, offline_access, User.Read, Mail.Read, Mail.ReadWrite and Calendars.ReadWrite. Mail.ReadWrite permits mailbox writes but does not grant Mail.Send; the calendar permission is broader than the app uses. Every Graph request passes a method, path, query and body allowlist. Allowed writes are marking mail read, requesting flag clearing, creating a text-only draft and creating a calendar block with no attendees. Sending, forwarding, moving, deleting, category changes, attachments, draft edits or deletion, and reading, editing or deleting existing calendar events are blocked.

Email is treated as untrusted

Anyone can send you an email, including people trying to trick an AI. So Killer Email treats every email as untrusted input. The AI that sorts your mail has no tools and can't take any action. It can only make suggestions, and every suggestion is checked in code before you see it. Anything that fails those checks is left for you to sort manually.

Killer Email uses OpenAI models through Lovable's AI gateway. Sorting Gmail and Outlook mail uses OpenAI's GPT-6 Luna model; reply drafts, delegation briefs and calendar reading use OpenAI's GPT-6 Astra model. For sorting Gmail and Outlook mail, it receives the sender name and address, subject and the provider's preview trimmed to 240 characters. For reply drafts and delegation briefs, it receives the sender name, subject, the trimmed preview and Killer Email's own previous one-line action. When you press Add to calendar, it receives the subject, the trimmed preview, the one-line action and initially the first 4,000 characters of that one email's body. Only if event details are missing does it receive more, up to an absolute maximum of 8,000 characters. Each AI pass counts toward your AI allowance. Gmail text is extracted from plain text or HTML; Outlook requests text, but the response may contain HTML. This body content is not stored by Killer Email. The models never receive attachments. Requests are sent with storage disabled (store: false).

Senders that fail Gmail's own authenticity checks are flagged as unverified. They never land in Today, and Killer Email never suggests paying them. Emails about payments or sign-ins carry a reminder to verify the sender elsewhere first.

Account protection

• Two-factor authentication with an authenticator app is required before the desk or protected actions are available.
• Connecting a new Gmail or Outlook account and deleting Killer Email require a sign-in and second factor completed within the previous 15 minutes.
• Sign-up uses Cloudflare Turnstile bot protection and rate limiting.
• Connection, sync, initial scan, AI draft, draft save, calendar proposal, Clear Quarantine and account deletion operations have server-side rate limits where appropriate.
• Google connection returns use a user-bound, single-use ticket. It expires for use after 15 minutes and is removed from storage within one day.
• Microsoft connections use a reserved, user-bound pending slot and a one-time returned code; the pending connection expires after 30 minutes.
• Leaked-password protection is enabled for password accounts.

Data and infrastructure protection

• Connections use HTTPS. Published responses include HSTS, content-type, referrer, permissions, framing and Content Security Policy headers.
• Database row-level rules restrict user-facing records to their owner.
• Connection keys, scan records, rate limits and connection tickets are server-only.
• Google OAuth tokens are stored by Killer Email, encrypted with AES-256-GCM. The encryption key exists only in the server's private configuration; tokens are decrypted only on the server and never reach the browser or logs.
• Microsoft OAuth tokens are managed by Lovable's connection service. Killer Email stores its Microsoft connection key encrypted with AES-256-GCM, not Microsoft access or refresh tokens.
• Server-side access is limited by role, and production dependencies are checked for known security issues.

Logging

Operational logging records status codes, redacted Google and Microsoft paths, internal connection identifiers and short error messages. Our logging calls do not include email previews, subjects, sender addresses, draft text, OAuth tokens or connection keys. Your separate, user-visible Activity log does include the connected address and subject so you can audit changes.

Known limitations and risks

• AI can misclassify. Important mail may land in Quarantine, and junk may land in the action list. Quarantined mail stays in Gmail or Outlook, so review Quarantine before clearing it.
• A crafted email could still influence a suggestion's wording or priority despite the safeguards. The AI has no tools, and nothing is acted on without you.
• AI drafts and proposed event times can be wrong. Review and edit them before saving.
• Sender warnings can have false positives, including help desks and newsletters, and false negatives. A clean result does not prove an email is genuine.
• Killer Email depends on Google, Microsoft, Lovable, OpenAI, Stripe and Cloudflare. An outage, policy change or breach at one of them could affect the service. Google tokens are held by Killer Email, encrypted at rest.
• No system is perfectly secure.

Disconnect or revoke access

Disconnecting erases the connection and its associated Killer Email data. Gmail tokens are revoked at Google. Outlook access is revoked by deleting the connection through Lovable's connection service, then checking that Killer Email's old connection key is refused, so no Microsoft token remains usable by Killer Email. Microsoft may still list the app's consent on its side. Both retry with backoff; if revocation can't be confirmed, the failure is logged and alerted, and Killer Email's stored token or key is destroyed anyway. The same verified revocation runs when you disconnect one account, delete your Killer Email account, or when a cancelled plan reaches the end of its paid period. Outlook mail and calendar share a connection, so removing Outlook removes both and clears its selection as the destination. You can also revoke access at Google account permissions. For Microsoft, review Microsoft app permissions; work or school permissions may be managed by your organization.

Who built this

Killer Email is made by Jozi Firecracker Factory LLC, a design and product studio based in Portland, Oregon. For almost 20 years we've designed and built digital products for some of the most security-conscious companies on earth, including Microsoft, Oracle, IBM, BMW and New Relic. In that world, privacy reviews, security audits and "what happens if this goes wrong?" are part of every design decision, not an afterthought.

For most of that time, studios like ours made the websites, campaigns and digital experiences that pointed people toward someone else's product. AI has changed that. A small, senior team can now design, build and run real software of its own. So we're taking the craft we spent two decades applying for enterprise clients and pointing it at products of our own: tools that are delightful to use, honest about how they work, and held to the same security standards our biggest clients demand. We built Killer Email for our own inboxes first, which is the best reason we know to get this right.

Responsible disclosure

If you find a security issue, email apps@jozi.co or read our security.txt. A real human reads every message. Ironically, by email. We aim to acknowledge reports within a few business days. We will not pursue good-faith research that avoids privacy violations, data destruction and service disruption.

Privacy

Collection, retention and deletion are explained in the Privacy Policy.

We built this for you, if you're as protective of your inbox as we are. Paranoid? Good. So are we.